Privacy Policy
This is the same policy shown inside the Vararuchi app (Settings → Privacy), published here for transparency. The in-app version is where you exercise data controls such as Export My Data and Delete My Account. See also the Terms of Service.
1. What data we collect
We collect data only necessary to provide the service:
- Identity: Name and email from Google Sign-In (OAuth). We never store your Google password.
- Learning data: Topics studied, quiz scores, flashcard progress, knowledge mastery sessions, career roadmap, language learning history, and AI response style preferences (goal, pace, verbosity).
- Usage data: Spark (credit) usage, feature access timestamps, subscription tier.
- Uploaded content: Documents, audio files, and images you submit for AI analysis. Files are deleted from our servers after indexing. Text representations (embeddings) derived from your content are stored in our vector database (Pinecone) to power the Knowledge Mastery search feature; these are deleted when you delete the source or delete your account.
- Payment data: Order IDs and payment confirmation from Razorpay. We never receive or store card numbers. Payment records are retained for 6 years as required by the GST Act, 2017.
- Student verification data: For users applying for the Student discount plan — academic email address, institution name, enrollment dates, and a photo of your student ID card. Collected only with your explicit consent during the verification flow, used solely to verify student status, and retained for a maximum of 1 year. You may request deletion at any time. Governed by the Digital Personal Data Protection Act, 2023.
- Community data: Help Center posts, replies, bug reports, and feature requests that you create. Publicly visible to other users.
- Consent records: Date and version of the Terms of Service and Privacy Policy you accepted, stored for audit purposes.
- Technical data: Browser type, device type, IP address (server logs retained 90 days), Firebase Analytics events (only if you accepted analytics cookies).
- App Check signals: reCAPTCHA v3 browser signals used by Firebase App Check to prevent automated abuse. Governed by Google's reCAPTCHA Privacy Policy.
2. Legal basis for processing (GDPR)
For users in the European Economic Area and UK, we process personal data under the following legal bases (GDPR Art. 6):
- Performance of contract (Art. 6(1)(b)): Processing necessary to provide the AI tutoring service, manage your subscription, and process payments.
- Consent (Art. 6(1)(a)): Analytics cookies and student verification data — you may withdraw consent at any time in Settings → Privacy.
- Legitimate interests (Art. 6(1)(f)): Security logging, abuse prevention, crash reporting, and service improvement through anonymised analytics.
- Legal obligation (Art. 6(1)(c)): Retaining payment records for 6 years under the GST Act, 2017.
3. How we use your data
- To deliver personalised AI tutoring and track learning progress.
- To process payments and manage subscription tiers.
- To prevent abuse and enforce usage limits (Sparks system).
- To improve the service through anonymised analytics (only with your consent).
- We do not sell, rent, or share your personal data with third parties for marketing.
- We do not use your learning data or uploaded content to train AI models.
4. Third-party services
We use the following sub-processors, each governed by their own privacy policies:
- Google Firebase — Authentication, Firestore database, file storage, hosting, and analytics
- Google Cloud Run — Serverless compute hosting for our backend API
- Vararuchi AI Engine — AI inference for all tutoring and learning responses (backed by third-party AI infrastructure providers under Data Processing Agreements)
- Pinecone — Vector database for Knowledge Mastery document search (RAG); hosted on AWS us-east-1
- Deepgram — Audio transcription for lecture and recording uploads
- Firecrawl — Web content extraction for URL-based knowledge ingestion
- Razorpay — Payment processing (PCI-DSS Level 1 compliant); we never receive card or bank details
- Upstash Redis — Rate-limiting cache; stores anonymised user ID and request count only
- Sentry — Crash reporting; error events are scrubbed of personally identifiable information before transmission. Sentry retains event data for 90 days.
All sub-processors are bound by Data Processing Agreements (DPAs) consistent with GDPR Art. 28 and DPDPA 2023 § 8. Cross-border transfers to processors outside India and the EU are governed by Standard Contractual Clauses (SCCs) or equivalent safeguards.
5. Data retention
- Your account data is retained until you delete your account.
- Uploaded files are deleted from our servers immediately after processing.
- Document embeddings (vectors) in Pinecone are deleted when you delete the source document or when you delete your account.
- Payment audit logs are retained for 6 years as required by the GST Act, 2017.
- Server access logs are retained for 90 days.
- Student verification photos are retained for up to 1 year from verification and then deleted.
- Community posts remain unless you delete them. Deleted posts are permanently removed.
6. Your rights (GDPR / DPDPA / CCPA)
Under applicable law (GDPR, DPDPA 2023, and CCPA), you have the right to:
- Access your personal data — use "Export My Data" in Settings → Privacy (complete JSON download from our servers).
- Rectify inaccurate data — contact us at admin@vararuchi.com.
- Erase your data — use "Delete My Account" in Settings → Privacy. This permanently deletes all learning data, uploaded content, vectors, and community posts. Note: payment records are retained for 6 years per GST Act, 2017.
- Portability — "Export My Data" in Settings provides your full personal data across all features in machine-readable JSON format.
- Restrict processing or object — email us and we will suspend processing within 7 days.
- Withdraw consent — change analytics cookie preferences at any time in Settings → Privacy → Cookie Preferences.
- Lodge a complaint — you have the right to lodge a complaint with your local data protection authority. In the EU: your national DPA (see edpb.europa.eu). In India: the Data Protection Board of India (when operational). In the UK: the Information Commissioner's Office (ico.org.uk).
California residents (CCPA): You have the right to know what data we collect, the right to delete it, and the right to opt out of sale (we do not sell data). We do not discriminate against users who exercise CCPA rights. Requests: admin@vararuchi.com (response within 45 days).
To exercise any right, email admin@vararuchi.com. We respond within 30 days (45 days for CCPA requests).
6a. Deleting your account and data
You can delete your Vararuchi account and its data at any time. You do not need the app installed.
Delete it yourself, from the web
Go to the account deletion page. Sign in with your Google account and confirm — deletion starts immediately. This works in any browser, with or without the app.
In the app
Open Settings → Privacy → Delete My Account and confirm.
Or ask us
Email admin@vararuchi.com from the email address on the account. We verify ownership of the address and then delete the account. We respond within 30 days and normally complete deletion within 7.
Deleting only some of your data
You do not have to delete your whole account. You can delete individual Knowledge Mastery uploads (which also removes the AI embeddings made from them), your own community posts, and your learning history from Settings. See the deletion page for the full list.
What is deleted
- Your account and sign-in identity.
- All learning data — topics, sessions, progress, mastery, streaks, exam attempts and results.
- Everything you uploaded to Knowledge Mastery, including the file itself and its document embeddings (vectors) in Pinecone.
- Photo Solver images and their solutions.
- Your community posts and replies.
- Student verification documents and photos, where held.
What is retained, and why
- Payment records — 6 years. Required by the GST Act, 2017. These are financial records of a completed transaction; they are kept whether or not the account still exists, and are not used for any other purpose.
- Server access logs — 90 days, then automatically discarded.
- Crash reports — 90 days in Sentry, already stripped of information identifying you.
If you bought a subscription through Google Play, deleting your Vararuchi account does not cancel it. Cancel it in Google Play → Subscriptions, or you will continue to be billed by Google.
7. Cookies & local storage
We use:
- localStorage / IndexedDB (essential): Storing your learning sessions and preferences locally for offline access. Always active as these are required for the app to function.
- Firebase session cookies (essential): Managed by Firebase Authentication for secure sign-in. Always active.
- Analytics cookies (optional): Firebase Analytics usage events. Only activated if you click "Accept all cookies." You can change this preference any time in Settings → Privacy → Cookie Preferences.
- reCAPTCHA v3 (essential): Browser signals collected by Firebase App Check to prevent automated abuse of the service.
8. Security
All data is transmitted over HTTPS. Firestore and Firebase Storage are protected by server-enforced security rules (owner-only access). Sensitive operations (subscription upgrades, payment processing, account deletion) are performed exclusively server-side using Firebase Admin SDK. Rate limiting and MIME type validation protect upload endpoints.
In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware (GDPR Art. 33) and affected users without undue delay where the breach is likely to result in high risk (GDPR Art. 34). Under DPDPA 2023, we will notify the Data Protection Board as required by applicable rules.
9. Children and young people
You must be at least 13 to hold a Vararuchi account, in every country. The age at which you may agree to our use of your data on your own behalf depends on where you live — 18 in India (Digital Personal Data Protection Act 2023, § 9), between 13 and 16 across the EU/EEA (GDPR Art. 8), and 13 in the United Kingdom, United States and most other countries. We ask for your year of birth and your country once, at sign-up.
Everyone under 18 is treated as a child, whatever their country. For those accounts we do not carry out behavioural tracking, profiling or targeted advertising, we do not enable analytics, and we do not use location to vary prices. Subscriptions cannot be purchased by an under-18 — a parent or guardian must buy on their behalf. Free daily Sparks are unaffected.
Where a learner is below the age of consent for their country, a parent or guardian must give consent for us to process their data. We are building a verified guardian-consent flow and will require it before 13 May 2027, the date this obligation takes effect in India. Until then, if you are a parent or guardian and want to review, withdraw consent for, or delete your child's account, email us and we will act on it.
If you believe a child's data has been collected without proper consent, contact us at admin@vararuchi.com and we will delete the data within 72 hours.
10. Changes to this policy
We will notify users of material changes via in-app notification at least 14 days before the change takes effect. Continued use after the effective date constitutes acceptance.
Regional privacy addendums
California (CCPA / CPRA)
In addition to the rights above, California residents have the following additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
- Right to Know: Request disclosure of the categories and specific pieces of personal information collected about you, the categories of sources, and the business purposes for collection.
- Right to Delete: Request deletion of personal information we hold about you, subject to certain exceptions (e.g., payment records kept for legal compliance).
- Right to Correct: Request correction of inaccurate personal information. Contact admin@vararuchi.com with the correction requested.
- Right to Opt Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. No action is required.
- Right to Limit Use of Sensitive Information: We only use sensitive personal information (student ID, academic email) for the purpose of verifying your student status. We do not use it to infer characteristics about you.
- Right to Non-Discrimination: We do not discriminate against you for exercising your CCPA/CPRA rights.
- Verified requests will be responded to within 45 days. To submit a request, email admin@vararuchi.com.
Canada (PIPEDA / Law 25 Quebec)
- Personal information is collected with your knowledge and consent, and only for the purposes described in this Privacy Policy.
- You may access or correct your personal information by contacting admin@vararuchi.com. We will respond within 30 days.
- Commercial electronic messages (if sent) comply with Canada's Anti-Spam Legislation (CASL). You may unsubscribe at any time via the link in any email we send.
- Privacy complaints may be directed to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Australia (Australian Privacy Act 1988)
- We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).
- You may request access to or correction of personal information held about you. Contact admin@vararuchi.com. We will respond within 30 days.
- If you are unsatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.
- We do not transfer personal information outside Australia except to providers listed in our Privacy Policy, each of which provides equivalent data protection obligations.
Singapore (Personal Data Protection Act 2012)
- We comply with Singapore's Personal Data Protection Act 2012 (PDPA).
- You have the right to access and correct your personal data. Contact admin@vararuchi.com. We will respond within 30 days.
- Complaints may be directed to the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.
Brazil (Lei Geral de Proteção de Dados — LGPD)
- We comply with Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD), Law No. 13,709/2018.
- You have the right to confirm the existence of, access, correct, anonymize, block, delete, and port your personal data.
- The legal bases for processing your data are performance of contract (service delivery), consent (analytics cookies, student verification), and legal obligation (payment record retention).
- To exercise your rights or lodge a complaint, contact admin@vararuchi.com. Complaints may also be directed to the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.